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Abstract 

We prove that QIP(2), the class of problems having two-message quantum interactive proof 
systems, is a subset of PSPACE. This relationship is obtained by means of an efficient parallel 
algorithm, based on the multiplicative weights update method, for approximately solving a 
certain class of semidefinite programs. 

1 Introduction 

Since their introduction roughly 25 years ago IBabSSl IGMR85|I , interactive proof systems have 
become a fundamental notion in the theory of computational complexity. The expressive power 
of one of the most basic variant of the interactive proof system model, wherein a polynomial- 
time probabilistic verifier interacts with a computationally unbounded prover for a polynomial 
number of rounds, is characterized IILFKN921 ISha92|l by the well-known relationship 

IP = PSPACE. 

Many variants of interactive proof systems have been studied, including public-coin interactive 
proof systems (or Arthur-Merlin games) IIBab85l[BM88l IGS891I , zero-knowledge interactive proofs 
IIGMR891IGMW9T1I and multi-prover interactive proofs IIBOGKW88L 

This paper is concerned primarily with quantum interactive proof systems, which are de- 
fined in a similar way to ordinary interactive proof systems except that the prover and verifier 
may perform quantum computations. Like their classical analogues, several variants of quan- 
tum interactive proof systems have been studied, including ordinary quantum interactive proofs 
IIWat03l IKWOO| . public-coin quantum interactive proofs l|MW05L zero-knowledge quantum in- 
teractive proofs | |Wat02l IWat06l IKobOSl IHKSZ08L and multi-prover quantum interactive proofs 
IIKM031 iKKMVOSl . The complexity class QIP of problems having quantum interactive proof sys- 
tems is known BKWOOI to satisfy 

PSPACE C QIP C EXP. 

The containment QIP C EXP follows from the existence of polynomial-time algorithms for ap- 
proximately solving semidefinite programs IIGLS93I . (Somewhat simpler proofs of the contain- 
ment QIP C EXP follow from the results of IIBATS091 IWat09bL but these proofs still require effi- 
cient algorithms for solving convex/ semidefinite programs.) 

Quantum interactive proof systems have an interesting property that classical interactive proof 
systems are conjectured not to hold, which is that they can be parallelized to a constant number 
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of rounds of interaction IIKWOOL More precisely, it holds that Q1P(3) = QIP, where in general 
QlP(m) denotes the class of problems having quantum interactive proof systems in which m mes- 
sages are exchanged between the prover and verifier (with the prover always sending the last 
message). This leaves four basic classes that are defined naturally by quantum interactive proof 
systems: QIP(O) = BQP, QlP(l) = QMA, QIP(2), and QIP(3) = QIP. Of these classes, Q1P(2) 
seems to be the most mysterious. It is known that eMIP* C QIP(2) IIWeh06| and QSZK C QIP(2) 
IIWat02irVVat06L Here, ©MIP* denotes the class of problems having one-round two-prover classi- 
cal interactive proof systems in which the provers share quantum entanglement, answer one bit 
each, and the verifier accepts or rejects based on the parity of these bits; and QSZK denotes the 
class of problems having statistical zero-knowledge quantum interactive proof systems. No up- 
per bound other than the trivial containment QIP(2) C QIP, which implies QIP(2) C EXP, was 
previously known. 

In this paper we prove the new containment: 

QIP(2) C PSPACE. 

Similar to QIP C EXP, this containment is proved using semidefinite programming; but this time 
the containment is achieved by using an NC algorithm rather than a sequential polynomial-time 
algorithm. Our algorithm is based on the multiplicative weights update method, which was devel- 
oped by several researchers and is described in the survey IIAHK05I and in the PhD thesis of Kale 
IIKal07l . In particular, our algorithm is based on a general method that was independently dis- 
covered by Arora and Kale I1AK07I and Warmuth and Kuzmin IIWK061 . The key aspect of this 
approach that makes it useful for proving QIP (2) C PSPACE is its parallelizability: it is an it- 
erative method in which each iteration is easily parallelized, and is such that only a very small 
number of iterations is needed for an approximation that is accurate enough for our needs. A 
related approach was used by two of us |JW09[ to prove the containment of a different quantum 
complexity class (called QRG(l)) in PSPACE, but the specific technical details of the simulations 
are rather different. 

The rest of this paper has the following structure. We begin with Section |2l which includes a 
brief discussion of background information needed for the rest of the paper, including linear alge- 
bra notation and parallel algorithms for matrix computations. Section |3] introduces two-message 
quantum interactive proof systems and establishes a simple fact concerning their robustness with 
respect to error bounds. In Section |4] we present a semidefinite programming formulation of the 
maximum probability with which a verifier in a two-message quantum interactive proof system 
can be made to accept, and the actual simulation of QIP (2) in PSPACE is split into the three sec- 
tions that follow: Section|5]presents an overview of the simulation, while Sections |6] and [7| describe 
in more detail its two most technical parts. The precision requirements of the entire simulation are 
discussed in Section |8l and the paper concludes with Section |9l 

2 Preliminaries 

2.1 Linear algebra notation and terminology 

For complex vector spaces of the form X = C^ and y — C^, we write L {X , y) to denote the 
space of linear operators mapping X to y, which is identified with the set of M x Af complex 
matrices in the usual way. An inner product on L {X ,y) is defined as (A, B) = Tr(A*B) for all 
A, B G L {X, y), where A* denotes the adjoint (or conjugate transpose) of A. The notation L [X) 
is shorthand for L {X,X), and the identity operator on X is denoted Ix (or just 1 when X is 
understood). 
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The following special types of operators are relevant to the paper: 



1. An operator A e L (M) is Hermitian ii A = A* . We write \{ A) = (Ai(A),. . .,Am(A)) todenote 
the vector of eigenvalues of A, sorted from largest to smallest: Ai(A) > A2(A) > ■•• > A]v(A). 

2. An operator P G L (Af) is positive semidefinite if it is Hermitian and all of its eigenvalues are 
nonnegative. The set of such operators is denoted Pos (A"). The notation P > also indicates 
that P is positive semidefinite, and more generally the notations A < B and B > A indicate 
that B — A > for Hermitian operators A and B. 

3. A positive semidefinite operator n G Pos (Af) is a projection if all of its eigenvalues are either 
or 1. (Sometimes such an operator is called an orthogonal projection, but we have no need to 
discuss the more general sort of projection.) 

4. An operator p G L (Af) is a density operator if it is both positive semidefinite and has trace equal 
to 1. The set of such operators is denoted D{A!). 

5. An operator LT G L (A") is unitary iiU*U = \x- The set of such operators is denoted \J {X). 

Three operator norms are discussed in this paper: the trace norm, Frobenius norm, and spectral 
norm, defined as 



II A 11^ = Tr VA*A, II AII2 = '^(A, A) , and || A|| = max{|| Aw || : w G A", || m|| = 1} 

respectively, for each A G L{X). Alternately, these norms are given by the 1, 2 and 00 norms of 
the vector of singular values of A. For every operator A it holds that ||A|| < ||A||2 < ||A||^. We 
also use the inequalities |(A,B)| < ||A|| ||B||p ||AB|| < ||A|| ||B||,and ||AB||^ < ||A|| ||B||;^ a few 
times in the paper. The fidelity function is defined as 

F(P,Q) = \\^/P^/Q 

for positive semidefinite operators P and Q of equal dimension. 

A super-operator is a linear mapping of the form O : L (A") L [y), for spaces of the form 
X — and y = C^. The identity super-operator on L {X) is denoted Il(a')- The adjoint super- 
operator to ^ is the unique super-operator O* : L (y) -^L{X) for which (Y, 0(X)) = (O* (Y), X) 
for all X G L {X) and Y G L (y). 

The following special types of super-operators are relevant to the paper. 

1. ^ : L{X) ^ L {y) is completely positive if it holds that (O (g) 1l(>v))(P) G Pos (3^ W) for 
every choice of W = C*" and P G Pos {M 0W). 

2. O : L (Af) ^ L (3^) is trace-preserving if Tr(<l>(X)) = Tr(X) for every X G L (A"). 

3. O : L {X) L (y) is a quantum operation (also called an admissible super-operator or a quantum 
channel) if it is both completely positive and trace-preserving. 



2.2 Remarks on NC and parallel matrix computations 

To prove that QIP(2) is contained in PSPACE, we will make use of various facts concerning parallel 
computation. First, let us recall the definition of two complexity classes based on bounded-depth 
circuit families: NC and NC (po/y). The class NC contains all functions that can be computed 
by logarithmic-space uniform Boolean circuits of polylogarthmic depth, while the class NC (po/y) 
contains all functions that can be computed by polynomial-space uniform families of Boolean 
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circuits having polynomial-depth. By restricting these classes to predicates we obtain classes of 
languages (or more generally promise problems). 

There are a few facts about these classes that we will need. The first fact, which follows from 
IIBor77|l . is that for languages (or promise problems) we have NC (po/y) C PSPACE. (In fact it 
holds that NC(po/y) = PSPACE, but we only need a containment in one direction.) The second 
fact is that functions in these classes compose nicely. In particular, if F : {0,1}* — > {0,1}* is a 
function in NC{poly) and G : {0, 1}* {0, 1}* is a function in NC, then the composition G o F is 
also in NC(po/y). This follows from the most obvious way of composing the families of circuits 
that compute F and G, along with the observation that \ F{x) \ can be at most exponential in | x | . 

Finally, we will make use of the fact that many computations involving matrices can be per- 
formed by NC algorithms. We will restrict our attention to matrix computations on matrices 
whose entries have rational real and imaginary parts. Numbers of this form, a = (a/b) +i{c/d) 
for integers a, h, c, and d, are sometimes referred to as Gaussian rationals. We assume any num- 
ber of this form is encoded as a 4-tuple (fl, h, c, d) using binary notation, so that the length of a is 
understood to be the total number of bits needed for such an encoding. 

It is known that elementary matrix operations, such as additions, multiplications, and inver- 
sions, can be performed in NC. (The survey IIGat931 , for instance, describes NC algorithms for 
these tasks.) We will also make use of the fact that matrix exponentials and spectral decompo- 
sitions can be approximated to high precision in NC. In more precise terms, we have that the 
following problems are in NC: 

Matrix exponentials 

An n X n matrix M, a positive rational number e, and an integer k expressed in 
unary notation (i.e., 1*^), such that || M|| < k. 

An n X n matrix X such that || exp(M) — X || < £. 

Spectral decompositions 

An n X n Hermitian matrix H and a positive rational number e. 
An n X n unitary matrix U and an n x n real diagonal matrix A such that 

\\M-UAU*\\ < £. 

Singular-value decompositions 
An n X m matrix M and a positive rational number e. 

An n X r matrix U with orthonormal columns, an m x r matrix V with orthonormal 
columns, and an r x r diagonal matrix Z, with positive diagonal entries such that 

\\M-U1.V*\\ < £. 

Note that in these problems, the description of e has roughly log(l/e) bits, which means that 
highly accurate approximations are possible in NC. The fact that matrix exponentials can be ap- 
proximated in NC as claimed follows by truncating the series 

exp(M) = 1 + M + mV2 + mV6 + • • ■ 



Input: 
Output: 

Input: 
Output: 



Input: 
Output: 
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to a number of terms polynomial in k and log(l/£). (This is not a very practial way to compute 
matrix exponentials, but it establishes the fact we need.) The fact that spectral and singular value 
decompositions can be approximated in NC follows from a composition of known facts: in NC one 
can compute characteristic polynomials and null spaces of matrices, perform orthogonalizations 
of vectors, and approximate roots of integer polynomials to high precision IICsa76llBGH82l[BCP83l 
IBOFKT861 lGat93l lNiF94 J . 

3 Two-message quantum interactive proof systems 

The purpose of this section is to introduce the class QIP(2), including its definition and a simple 
proof that it is robust with respect to error bounds. For a general discussion of quantum interac- 
tive proof systems, as opposed to the somewhat simplified case in which only two messages are 
exchanged, the reader is referred to IIKWOO|l and IIWat09aL 

3.1 Definition of two-message quantum interactive proofs 

To define the class QIP(2), we begin by defining a two-message quantum verifier V as a classical 
polynomial-time algorithm that, on each input string x, outputs the description of two quantum 
circuits: Ux and Vx. The circuit Ux describes the verifier's initial preparation of a state, part of 
which is sent to the prover, while the circuit Vx describes the verifier's actions upon receiving a 
response from the prover. For the sake of simplicity, and without loss of generality, we assume 
that for every input string x, the circuits Ux and Vx are both composed of gates from some finite, 
universal set of unitary quantum gates whose entries have rational real and imaginary parts. The 
number of qubits on which the circuits Ux and Vx act is assumed to be equal to 2p{n), where 
n = |x| and p is some polynomial-bounded function. The first p{n) qubits represent the com- 
munication channel between the prover and verifier, while the remaining p{n) qubits serve as the 
private memory of the verifier. (It is not really necessary that the number of message qubits and 
private memory qubits agree, but it causes no change in the computational power of the model.) 

A two-message quantum prover P is simply a collection of quantum operations (or, equiv- 
alently, completely positive and trace preserving super-operators) {Y;c : x G {0,1}*}. Such a 
prover is compatible with a given verifier V if each operation l^x acts on p{n) qubits for the func- 
tion p mentioned above. 

An interaction between a two-message verifier V and a compatible prover P on an input x 
proceeds as follows: 

1. 2p{n) qubits are initialized in the |0) state. 

2. The circuit Ux is applied to all of the qubits. 

3. The prover 's operation Yx is applied to the first p{n) qubits. 

4. The circuit Vx is applied to all of the qubits. 

5. The first qubit is measured with respect to the standard basis, with the outcome 1 indicating 
acceptance and indicating rejection. 

Figured] illustrates such an interaction. 

Now, a promise problem A = (Ayes, ^no) is in QIP(2) if and only if there exists a two-message 
verifier V with the following completeness and soundness properties: 

1. (Completeness) If x G Ayes, then there exists a prover P that causes V to accept x with proba- 
bility at least 2/3. 
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Figure 1: An interaction between a verifier V and a prover P on an input x. The verifier's ac- 
tions are determined by the circuits Ux and Vx acting on 2p(n) qubits, while the prover's action 
corresponds to the quantum operation on just the first p{n) qubits. 

2. (Soundness) If x G A^o, then every prover P that is compatible with V causes V to accept x 
with probability at most 1/3. 

3.2 Robustness of QIP(2) with respect to error bounds 

It was proved in IIKWOOII that quantum interactive proof systems with negligible completeness 
error are amenable to parallel repetition. This allows for an exponential reduction in error for 
quantum interactive proof systems with three or more messages, because such proof systems can 
be transformed to have perfect completeness by a different method. However, this method does 
not work for two-message quantum interactive proof systems, because the perfect-completeness 
transformation requires the addition of messages. So, we will require a different method of error 
reduction. 

Assume that A is a promise problem in QIP(2) and that (V, P) is a two-message quantum 
interactive proof system for A with completeness and soundness probabilities bounded by a and 
b, where a — b > 1/q for some polynomial-bounded function q. We will define a new verifier V 
that has completeness probability at least 1 — 2^'' and soundness probability at most 2^'', for any 
choice of a polynomial-bounded function r. A description of V follows. 

1. Let s = 2rq and let t = Srq^s. Run st independent, parallel executions of the protocol for V, 
one for each pair (/,;) with z G {1, . . . , s} and 7 G {!,..., t}. Measure the output qubit for each 
execution, and let the result of the measurement for execution (z,/) be y,y G {0, 1}. 

2. For each i = 1, . . . ,s, set 

/ 1 if Lj.iy.;>f-^ 

Zi= < 

[ otherwise 

3. Accept if ALi = 1' reject otherwise. 

Now let us consider the maximum probability with which V can be made to accept. Suppose 
first that an input x G Ayes is fixed, so that V is made to accept with probability at least a by 
the prover P. Our goal is to define a prover P' that causes V to accept with probability at least 
1 — 2^''. This is easily done by defining P' so that it runs st independent simulations of P. Let Yy 
and Z;, for / G {1, . . . , s} and / G {1, . . . , f }, be Boolean-valued random variables corresponding to 
the values and z, when V interacts with the prover P' just described. Given that P' simulates 
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st independent copies of P, we have that the random variables Y, y are independent and satisfy 
£[^1,;] > a for each pair By the Chernoff Bound, we therefore have 



Pr[Z; = 0] = Pr 



Yit <at(l 



a — h 
2a 



< 



exp 



8a 



[a-bf] <e 



and thus the probability of rejection is at most se^''^ < 2^''. 

Suppose on the other hand that an input x G Ano is fixed, so that no prover P can convince V 
to accept with probability greater than b. Fix an arbitrary prover P', and as before let Yj^j and Z, 
be Boolean- valued random variables corresponding to y, y and Zj. There may not be independence 
among these random variables, as P' may not treat the parallel executions independently. We do 
know, however, that E[y/ y] < b for every given that the maximum acceptance probability of V 
is b. By Markov's Inequality we therefore have 



Pr[Z,- = 1] = Pr 



Y; 1 + ■ ■ 



t{a + b) 



< 2 



i,t\ 



t{a + h) 



We may view Zi, . . . ,Zs as being the outcomes of s parallel executions of a quantum interactive 
proof system that accepts with probability at most 1 — ^ • The verifier V' accepts if and only if all 
of these executions accept, and so by the result on parallel repetition proved in | [KWOO| we may 
conclude that the probability of acceptance of V is at most 



< exp 



Thus, the verifier V' has been shown to have completeness and soundness probabilities as 
required, completing the proof. 



4 Maximum acceptance probability as a semidefinite program 

The maximum acceptance probability of a verifier in a quantum interactive proof system can be 
phrased as semidefinite programming problem BKWOOL For this paper a semidefinite program- 
ming formulation based on ones described in IIGW07llV\^t09bll will be used. 

Suppose y is a two-message verifier, and that an input string x of length n is being considered. 
Let us also define 

\rp) = U, |02P(")) and n = v; {1\ (g)l)V,. 

In words, \xp) denotes the quantum state initially prepared by the verifier, the first half of which is 
sent to the prover; and 11 denotes the projection operator corresponding to the accept outcome of 
the measurement that the verifier effectively performs after receiving the prover 's message. 

For convenience, we will assign distinct names to the complex vector spaces that arise from 
an interaction between V on input x and a compatible prover operation Y. Specifically, let A" 
denote the space corresponding to the verifier's message to the prover, let y denote the space 
corresponding to the prover 's response, and let Z denote the space corresponding to the verifier's 
private qubits. Thus, it holds that \xp) ^ (S> Z and EE is a projection ony Z. When the prover 
applies the operation Y ; L(A') L(3^)/ the verifier accepts with probability 

(n,(Y®lL(2))(|t/;)(t/;|)). (1) 
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To express the maximum probability for V to accept, over all choices of an operation Y, as a 
semidefinite program, it is helpful to recall the Choi-Jamiotkoivski representation of super-operators. 
Let us take { |0) , . . . , |N — 1) } to be the standard basis of A". Then the Choi-Jamiolkowski repre- 
sentation of Y : L (A:") ^ L {y) is the operator /(Y) G L (J^ ® A") defined by 

/(Y)= 

0<i,i<N-l 



It holds that Y is completely positive if and only if /(Y) is positive semidefinite | Jam72 rCho75| , 
and Y is trace-preserving if and only if Tr3;(/(Y)) =lx- 
Now let us write 

0<!<N-1 

for vectors {xpo) , IV'n-i) S Z, and define B G L {X, Z) as 

0<KN-1 

Then it is clear that 

(Y®lL(^))(|t/;)(t/;|) = {ly^B)J{l^){ly^B*). 
We therefore find that the probability of acceptance (d) may alternately be written 

(n, (I3; ® B)/(Y)(l3; ® B*)) = {{ly ^ r)n(l3; ® B) J(Y)) = (QJ(Y)) 

for Q = {ly (g) B*)n(l3; (g) B). We call Q the interactive measurement operator that is determined by 
V on input x. It is clear that the interactive measurement operator Q is positive semidefinite, and 
moreover that Q < I3; (8) ^ for the density operator ^ = B*B. 
Now, let us define 

^(Q)=max(Q,/(Y)), 

where the maximum is over all valid quantum operations of the form Y : — > L(3^). The 
quantity fi{Q) will be called the maximum acceptance probability of Q, as this value is precisely the 
maximum acceptance probability of the verifier V on input x, whose description alone has led 
us to the definition of Q. As stated above, when Y : L(A') — > L(3^) ranges over the set of all 
valid quantum operations, /(Y) ranges over the set of positive semidefinite operators satisfying 
the linear constraint Tr3;(/(Y)) = Ix- This implies that the quantity }i{Q) is represented by a 
semidefinite program: 

maximize: (Q/X) 
subject to: Tr3;(X) < l^-, 

X G Pos {y(^X). 

The feasible region of this semidefinite program is well-bounded (in the sense of IIGLS93I ), and 
therefore its optimal value f/(Q) can be approximated to high precision in time polynomial in the 
size of Q (which is exponential in |x|). This fact does not help us to prove QIP(2) C PSPACE, 
however. As is described in the next section, we will need an NC algorithm rather than just a 
polynomial-time algorithm to draw this conclusion. 

It will be necessary for us to rephrase the semidefinite program above, and to explicitly state 
its dual program. As will be discussed shortly, we will only need to consider this formulation for 
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invertible interactive measurement operators, so Q is hereafter assumed to be invertible. Define a 
super-operator O : L (3^ (8) Af) L (X ) as 

^{X)=Try (q-^/'XQ-i/2^ 

The adjoint super-operator <I>* : L {X) L {y (g) X) to ^ is given by 

^*{Y) = Q-^/^{ly^Y)Q-^/\ 

The value ji{Q) is then seen to be the optimal value of the following semidefinite program: 
Primal problem Dual problem 

maximize: Tr(X) minimize: Tr(y) 

subject to: <^{X) <lx, subject to: 0*(y) > ly^^-/ 

X G Pos(3^(8) A") . YgPos(A'). 

Strong duality follows from strict feasibility, which is easily verified, and so the optimal primal 
and dual solutions are given by ^(Q). 



5 Overview of the simulation 

We will now explain, in high-level terms, our simulation of QIP(2) in PSPACE. To prove that 
Q1P(2) C PSPACE, it will suffice to prove QIP(2) C NC{poly). This will be facilitated by the 
fact, discussed in Section I2.2[ that many computations involving matrices, including elementary 
operations such as addition, multiplication, and inversion, as well as approximations of spec- 
tral decompositions, singular-value decompositions, and matrix exponentials, can be performed 
inNC. 

For the remainder of this paper, assume that A = (Ayes, ^no) is an arbitrary promise problem 
in QIP(2), and let y be a two-message verifier for A that has exponentially small completeness 
and soundness error. The goal of the simulation is to determine whether or not V can be made to 
accept a given input string x with high probability. The variable n will always denote the input 
length n = \x\, and p{n) will denote the number of qubits exchanged by the verifier and prover 
on each of the two messages as discussed in Section |3l 

There are three main steps of the simulation: 

1. Compute from x an explicit description of \xp) and Yl. 

2. Process the description of the vector \tp) and the projection Yl into a well-conditioned interac- 
tive measurement operator Q and positive rational numbers 7 and £ satisfying 

X G Ayes => viQ) > (l + 4e)7/ 
X G Ano => }i{Q) < (l-4£)7. 

For some polynomial q it will hold that k(Q) < q{n), where k{Q) = \\Q\\ \\ Q^^ \\ denotes the 
condition number of Q. Moreover it will hold that l/q{n) < e and l/q{n) < 7. 

3. Use a parallel algorithm, based on the multiplicative weights update method, to test whether 
}i{Q) is larger or smaller than 7. 
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The first step is easily performed in NC{poly), using an exact computation. In particular, one 
may simply compute products of the matrices that describe the individual gates of the verifier's 
circuits. Given that this step is straightforward, we will not comment on it further. The second 
and third steps are more complicated, and are described separately in Sections[6]and[7|below. Both 
correspond to NC computations (where the input size is exponential in n), and by composing these 
computations with the first step just described, we will obtain that A is in NC (po/y), and therefore 
QIP(2) C PSPACE. 

6 Preparing a well-conditioned interactive measurement operator 

After the first step of the simulation, we have a unit vector \ip) and a projection operator U. Let us 
write M = 2P(") to denote the dimension of both of the message spaces and the verifier's private 
work space defined by V on input x, and let us also define Xq = C^, y = C^, and Zq = C^. We 
view that the space Xq corresponds to the verifier's message to the prover, that y corresponds to 
the prover 's message back to the verifier, and that Zq represents the verifier's private workspace; 
and thus \xp) G Xq(^ Zq and n G Pos {y Zq). The reason for subscripting Xq and Zq with is 
that we are viewing these as initial choices of spaces. In the processing of \^) and n, we will define 
an interactive measurement operator Q over spaces X , y and Z where X = and Z = for 
some choice of a positive integer N < M. 

Along the same lines as was discussed in Section|3l we may define an interactive measurement 
operator R G Pos {y ® Xq) as R = {ly O B*)n(l3; ^ B), for 

\^)= E \^)\^') and B= E \^pi){i\. 
0<KM-1 0<!<M-1 

The quantity }i{R) is precisely the maximum acceptance probability of V on input x, but nothing 
can be said about the condition number of R (which may not even be invertible). 

Our goal is to compute a new measurement operator Q G Pos (3^ ® X), where X = C'^ for 
some choice of N < M, along with positive rational numbers 7 and £, such that the following 
properties hold for some polynomial q: 

1. The interactive measurement operator Q is well-conditioned: k[Q) < cj[n). 

2. The values 7 and e are non-negligible: 1 /cj{n) < e and 1 /q{n) < 7. 

3. The value }i{Q) satisfies the properties 

X G Ayes => HQ) > (l + 4e)7, 
xeAno uiQ) < (l-4£)7. 

The first step in this process is to replace \xp) by a more uniform vector |^) G Xq Zq that is 
"similar enough" to \xp) in the sense to be described. We will, in particular, take |^) to be maxi- 
mally entangled over certain subspaces of Xq and Zq. This is done by performing the following 
operations: 

1. Let 

0<;<M-1 

be a Schmidt decomposition of\ip). 
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2. For each positive integer i, define the interval I, = (2 ',2 '+^] , and define 

= {/G {0,...,M-1} : Aj G . 

3. Let fc = p(n) + 1 and choose z G {1, . . . , A:} so that 



1 

2fc' 



The fact that such an i exists is proved below, and hereafter we write E = E, for this choice of i. 
4. Define 

Now, consider the interactive measurement operator S G Pos {y ® Xq) that is obtained by 
replacing \ip) with \(p) (with 11 unchanged). In other words, S is defined by the same process as R 
(which was determined hy \ip) and 11 as described above), and satisfies the equation 



(S,/(Y)) = (n,(Y®lL(2„))(|<^)(</.|)^ 
for every super-operator Y : L[?^q) L(3^). We will prove that 

<F{S)<4kii{R). (3) 

These are fairly loose bounds — ^but for the two extremes where }i{R) is exponentially close to 
or 1, the corresponding values for f<(S) will be separated by the reciprocal of a polynomial, which 
is good enough for our needs. 
First, note that 

and therefore 

1 

i=l;GE; ^ 

Thus, there must exist a suitable choice of i in step 3 so that 

as claimed. A lower bound on the size of E = E, may be obtained by noting that 

J]Ay <2-'+i|E| 

and therefore 

1^1 
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Now, the inner product of \tp) and \(p) is easily bounded from below as 



El - ' ' V ^1 V ~ Vifc 



and therefore 

II I'/') ii^i - \4>) {4>\ 111 = 2./i^mp)^' < 2/1^ - 2 - 4) • 

For every choice of an admissible super-operator Y : L (A'o) ^ L [y) it holds that 

0< (Y*®lL(2„))(n)<l;,„^2„, 

and by combining this observation with the fact that \ip){ip\ — |^) (^| is traceless we obtain 

(R - s, /(Y)) = ( (y* ® (n). It/.) (t/^i - 1</>) (-/'I ) < ^ II 1 1/^) (tpl - !</>) Ill < 1 - ^. 

Therefore 

f/(R)-/.(S)<l-l 

which establishes the lower bound on f/(S) claimed in (|3]l above. 

To establish the upper bound on f/(S), which is the second inequality in let us first choose 
an admissible super-operator Y so that 



H{S) = (n, (^Y^lL(2„)j(|</>)(</)|) 
Now, observe that 

1 1 

for each G S, and thus 

^Tr;,„(|</))(</)|)<Tr;,„(|i/;)(t/.|). 
It is therefore possible to choose a density operator ^ G D (3^ (g) Zq) such that 

(1 - 1) Tr3;(^) = Tr;,,{\:p){tp\) - 1 Tr;,„(|^) (</>|). 

Because Y is admissible, we may therefore conclude that 

Tr;,^{\^P){^P\) = Try (1 (y® {\cp){cp\) + (^1 - 1) ^) , 

and so there must exist an admissible super-operator E:L{Xo) ^ L (3^) so that 

(s®1l(^o)) = ^ (i</>)(</)|) + (1- ^) 

Consequently we have 

^{R) > (R,/(H)) = (n, (h®1l(2o)) (I'/')('/'I)) ^ ^(n. (^^^(^o)) (l</')('?l)) = ^m(s) 
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as required. 

Having obtained a uniform vector |^) that gives (when combined with EE) an interactive mea- 
surement operator S satisfying (O, we must make a couple of additional modifications to be sure 
that a well-conditioned interactive measurement operator has been obtained. 

First, we will replace and Zq with the spaces A! = and Z = for N = |Z|. Let 
X G U {X, Xq) and Z G U {Z, Zq) be linear isometries defined as 

N N 

X=X]I^;)01 ai^d Z=X]I^;)01' 

/=i /=i 

and define 

-1 N 

|t) = (X* ® Z*) \^) = -=Y \j) \j) and P={ly®Z*)Il {\y ® Z) . 

V N /=i 

It is clear that | r) is a unit vector and P is an ordinary measurement operator. (It might not be 
that P is a projection operator, but it is positive semidefinite and satisfies P < ly^^.) Finally, 
let Q G Pos (y ® X) he the interactive measurement operator defined by the vector |t) and the 
ordinary measurement operator 

1 \ „ 1 

It holds that 



and therefore 



Now let us verify that Q has the properties we require of it. First let us consider the condition 
number k(Q). It is easily shown that 

1 1 

and therefore k(Q) < 64/:. It remains to define normegligible values 7 and £, and to consider their 
relationship to f/(Q) in the two cases: x G Ayes and x G Ano- 

We have assumed that the original interactive proof system has exponentially small complete- 
ness and soundness errors, and therefore we may assume that for sufficiently large n we have 

1 1 

X G Ano ^ ^{R) < and X G Ayes => ^ 1 - 

(Alternately we may assume these bounds hold for all n by hard-coding small inputs x into the 
verifier.) Thus, by the bounds (H)) above, we have 

1 1 

X G Ano ^ /^(Q) < ^ and X G Ayes ^ }i{Q) > J^- 



By taking 



^=6ifc = 64(p(n)+l) ' ^"'^ ^(n)>64/c = 64(p(n) + l). 



we therefore have the properties required. 
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1. Let 



and 



8k(Q)2 

2. Let Wo = ly^x and let po = Wq/ Tr(Wo). 

3. For f = 0, . . . , T - 1 do: 

a. Compute a spectral decomposition of ^{pt 



N 

^iPt) = E'^;>y)(^;i■ 
i=l 

b. Let S = {/ G {1, . . . , N} : 7Ay > 1} and let s = Eyes '^y- 

c. If s < ^5 II Q^^ ||, then halt and accept. 

d. Let 



24 In(NM) 



e. Let 

Wf+i = exp 

andletpt+i = Wf+i/ Tr(Wt+i). 
4. Halt and re/ecf. 



o*(yo + ••• + ¥() , 



Figure 2: Algorithm to test if f/(Q) > 7. 

7 Verifying maximum acceptance probability 

We now describe and analyze a parallel algorithm, based on the multiplicative weights update 
method, to distinguish the two cases Q from the previous section. The algorithm operates as 
described in Figured and the super-operators O and O* are as defined in SectionHl 

7.1 Lemmas used in the analysis 

We will need a few basic facts and three lemmas to analyze the algorithm described in Figure |2l 
We begin by noting two facts concerning matrix exponentials. First, the Golden-Thompson Inequal- 
ity (see Section IX.3 of IIBha97ll ) states that, for any two Hermitian matrices X and Y of equal 
dimension, we have 

Tr < Tr (e^e^) . 

Second is the following inequality concerning the matrix exponential of positive semidefinite ma- 
trices. 

Lemma 7.1. Let P be an operator satisfying < P < 1. Then for every real number rj > 0, it holds that 

exp(— //P) <1 — r] exp(— //)P. 
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Proof. It is sufficient to prove the inequality for P replaced by a scalar A G [0, 1], for then the oper- 
ator inequality follows by considering a spectral decomposition of P. If A = then the inequality 
is trivial, so assume A > 0. By the Mean Value Theorem there exists a value Aq G (0, A) such that 

— = -//exp(-f/Ao) < -?/exp(-?7), 

which yields the inequality. □ 

For the proofs of the remaining two lemmas, some additional notation is used. Suppose that 
A" = C'^ and y = C^, and assume that the standard bases of these spaces are {|0) , . . . , |N — 1)} 
and { |0) , . . . , |M — 1) }, respectively. Then we define a linear mapping 

vec:L{X,y) y ^ X 

by taking vec(|/) (/j ) = |/) \ j) for each choice of z G {0, . . . , M — 1} and / G {0, . . . , N — 1}. 

Lemma 7.2. Let X = and y = for positive integers N and M. Let Po,Pi G Pos (X) and let 
Rq G Pos {X O y) satisfy Tr3;(Ro) = Po- Then there exists an operator G Pos {X O 3^) such that 
Try{R^) = Pi andF{Ro,Ri) = F(Po,Pi). 

Proof. By the monotonicity of the fidelity function, it must hold that F(Ro/ ) < F(Po, Pi ) for every 
choice of Ri satisfying Tr3;(Ri) = Pi. It therefore suffices to show that equality can be achieved. 

Choose a unitary operator V G U (X) for which \^\^V is positive semidefinite. For such 
a y it holds that F(Po, Pi) = Tr{^^/PlV). Now let W = C^^ and let |wo) e y X (^Whea 
purification of Rq. Given that |mo) also purifies Pq, it must take the form 



\uo) = Yec (^y%U* 
for some choice of a linear isometry LJgU(A',3^(8)>V). Finally, let 

Ri = Tr>v (vec (^y^VU*^ vec (^y^iVU* 
It holds that 

F(Ro,Ri)> (^/FoU^y/F^VW) =Tr(y^^v) =F(Po,Pi) 



as required. □ 

Remark 7.3. Lemma [7!2l is a fairly straightforward extension of Uhlmann's Theorem IIUhl76|l . (See 
also pages 410^11 of IINCOOI .') 

Lemma 7.4. Let Rq, Ri G Pos {W)for W = Then 



||Ko-Ri||i < ^2Tr(Ro)2 + 2Tr(Ri)2-4F(Ro,i^i)2. 

Proof. Choose V E V (W) so that y^y/RiV is positive semidefinite, and therefore F(Ro, Ri) 
Tr(v/Ro\/Ri^). We have that 



vec VRo G W (g) yy and vec ^/RiV G W O W 
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purify Rq and Ri, respectively, so by the monotonicity of the trace norm it holds that 



l|Ro-Ri||i < 
Using the inequality 



vec ^/Ro vec ^/Ro - vec V^i^ vec V^i^ 



A||^ < -w'rank(A) || A||2, 



which follows easily from the expressions of the trace and Frobenius norms in terms of singular 
values, along with the Cauchy-Schwarz inequality, we have 

||Ro-Ri||i < Vl 



vec ^/Ro vec ^/Ro - vec VRiV] vec V^i^ 



2Tr(Ro)^ + 2Tr(Ri)2 - 4Tr a/Rq VRi^ 



= J2Tr(Ro)2 + 2Tr(Ri)2-4F(Ro,Ri)2 



as required. 



□ 



Remark 7.5. When Rq = po and Ri = pi for density operators po and pi, we obtain the familiar 
inequality 



|||O0 -Pllli < 2^Jl-F{po,pl)^, 

or equivalently 

Hpo,pi) < ]J'^-\\\po-pifi, 
which is one of the Fuchs-van de Graaf inequalities l|FvdG99L 



7.2 Analysis of the algorithm (ignoring precision) 

Our algorithm cannot be implemented exactly using bounded-depth Boolean circuits: the spectral 
decompositions and matrix exponentials can only be approximated. However, for the sake of 
exposition, the issue of precision will be completely ignored in this subsection; meaning that we 
will imagine that all of the operations can be performed exactly. In the section that follows this 
one, the actual precision requirements of the algorithm are considered. As is shown there, it turns 
out that the algorithm is not particularly sensitive to errors, and in fact it is possible to perform 
all of the required computations in parallel with exponentially greater precision than would be 
required for the correctness of the algorithm. 

Let us consider first the case that the algorithm accepts. Let p = pt for the iteration t of the loop 
in step 3 in which acceptance occurs. To prove that the algorithm has answered correctly, we will 
construct an operator X G Pos (3^ (8) ^) such that 0(X) < ly and Tr(X) > (1 — 2)7; and therefore 
H{Q) > (1 ~ £)7- the conditions ^ on Q, this implies that }i{Q) > (1 + 4e)7, and therefore 
X G Ayes, as required. 

The operator X is defined as follows. First, let Rq = Q^'^^^pQ^'^^^, let Pq = Try(Ro) = 
and let 

I 

^1 = - El^;)(^;l + E^/>;)(^il• 
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By Lemma O there must exist Ri G Fos{y(^X) such that Try{Ri) = Pi and ¥{Ro,Ri] 
F(Po,Pi). We then take 

X = 7^/QRl^/Q. 

It holds that X > and 0(X) < l^- To establish a lower bound on Tr(X), we first note that 



l-Tr(yQRiv/Q) = (Q,Ro-Ki) < ||Q|| ||Ro-Ri|li- 
By Lemma [7!4l we conclude that 



11^0 -Ri 111 < ^2Tr(Po)2 + 2Tr(Pi)2-4F(Po,Pi)2. 
It holds that Tr(Pi) < Tr(Po), and we also have 

F(Po,Pi) > EAy = Tr(Po)-s>Tr(Po)-^||Q-i||. 

Therefore, given that Tr(Po) < || Q^^ \\, we have || Rq ~ Ri ||i ^ V83\\ \\, and so 
l-Trf^QRiVQ) < yS^llQ-^ll ||Q|| = V8Sk{Q) = e. 



It follows that 

Tr(X) = 7Tr (^Ri^) > (1 - e)j 



as required. 

Now let us consider the case that the algorithm rejects. Along similar lines to the previous 
case, we will construct an operator Y G Pos (X) such that 0*(Y) > ly(^x and Tr(y) < (1 + e)j. 
By the conditions (l2]) on Q this implies that //(Q) < (1 — 4£)7, and therefore x G Ano- In particular, 
we may take 

Y = ^(yo + --- + Vr-i). 

Each operator Yf satisfies 

Tr(YO = ^< JE7A; = 7, 

and therefore Tr(Y) < (1 + e)7. Each Yf is also clearly positive semidefinite, so it remains to prove 
that 0*(Y) > ty(^x- To this end we will first establish two conditions on each operator Y^ First, 
we have 

(pf,^*(Yf)) = (0(pf),Yf) = -V^i = 1- (5) 
Second, given that s > ^ || Q^^ \ \ for the case at hand, we have 

ll^*(^OII = IIQ"'^'(i3^^^f)Q"'^'ll < IIQ^'ll ll^fll = < l> 

and therefore ||(5^*(Yt) || < 1. 

Now, for the sake of clarity, let us write tj = e-y /2. Note that, for < f < T — 1, it holds that 

Tr(Wf+i) = Tr [exp(-;7^0*(Yo + ■ ■ ■ + Y^))] 

< Tr [exp(-//<5a)*(Yo + ■ ■ ■ + Yt_i)) exp(-//^0*(Yt))] 
= Tr[Wfexp(-/7<5O*(Y0)], 
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where we have used the Golden-Thompson Inequality. Given that ||^0*(yt) || < 1 we have by 
Lemma 17.11 that 

exp{-?]3^*{Yt)) <l-}]3exp{-r])^*{Yt), 

and therefore 

Tr(Wt+i) < Tr(Wt)(l - t]3exp{-t]) {pt,^*{Yt))) < Tr(Wt) exp(-//^ exp(-//)). 

(Here we have used the inequality exp(— a) > 1 — a, which holds for all real numbers a, as well 
as the fact that Tr(AB) < Tr(AC) whenever A > and B < C). Repeating this argument, and 
substituting Tr(Wo) = NM, we have 

Tr(Wr) < ]VMexp(-/^^5Texp(-^)). 

On the other hand, it is clear that 

Tr(Wr) = Tr [exp(-//^0*(Yo + ■ ■ ■ + Yr-i))] > exp{-^S\NM{^* {Yo + ■■■+ Yt-i))), 

and therefore 



T J J ~ rjST 

2 

Substituting the specified value of T, and using the fact that exp(— ?/) — ^ > 1 — ?/ (which holds 
for any rj G [0, 1]), we have 



Therefore 



ANM(0*(Y))>(l + e)(l-^) >1, 



and so O* (Y) > \yt^x as required. 

We therefore have that the algorithm works correctly, modulo the precision issues to be dis- 
cussed in the section following this one. It remains only to observe that it can be implemented in 
NC (meaning that it results in an NC (po/y) computation when composed with the first two steps 
of the simulation). Some of the details required to argue this can be found below; but at a high 
level one sees that each iteration of the loop in step 3 can be performed with high precision in NC, 
and the total number of iterations required is polynomial in n (and therefore polylogarithmic in 
the size of Q). 



8 Precision requirements for the simulation 

We now discuss the precision that is required for the simulation to yield a correct answer. It will 
turn out that the simulation is not particularly sensitive to errors, and one could in fact afford to 
take exponentially more precision than is required and still be within the class NC (po/y). 

The first step of the simulation, in which an explicit description oi\\p) and 11 is obtained, can 
be performed exactly in NC{poly) as has already been observed. So, let us move on to the sec- 
ond step, in which \ip) and 11 are processed to obtain a well-conditioned interactive measurement 
operator Q. This step requires the approximation of one singular value decomposition (to approx- 
imate the Schmidt decomposition of \xp) ), along with a few other operations that can be performed 
exactly or with high precision in NC. 
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For the moment let us denote by Q the actual operator that is computed by an NC implemen- 
tation of this step, as opposed to the true operator Q that would be output by an idealized, exact 
complex number algorithm. By computing the singular value decomposition to high precision, it 
is possible to take such an approximation so that 



Q-Q 



< 2 



_2poly(n) 



where poly denotes any polynomial of our choice. It is not difficult to prove that the quantity 
\V-{Q) ~ V{Q)\ is upper-bounded by N times || Q — Q||, and therefore we may take Q so that 



m)-m) 



< 2 



_2poh/(n) 



again for poly denoting any polynomial of our choice. We do not need this much precision: we 
only need a l/poly{n) separation between the values of f/(Q) for the cases x G Ayes arid x G A^o, 
which requires that || Q — Q|| is exponentially (rather than double-exponentially) small in n. So, 
to be concrete, we may decide to take sufficient precision so that 



Q-Q 



and therefore 
Thus, 



AQ)-¥iQ) 



X e A 



yes 



X e Ar 



}l{Q) > (l+3£)7 

UiQ) < (l-3e)7. 



(6) 



Hereafter we will return to writing Q rather than Q, with the understanding that Q now repre- 
sents an approximation that is stored by our algorithm. In addition, we will assume that \fQ, and 
therefore Q^^^^ as well, has Gaussian rational entries and is known precisely. This assumption is 
easily met by replacing Q with the square of a high precision approximation to \/Q. The point 
of this assumption is that we avoid having to consider an additional error term every time ^/Q 
or Q^^^'^ is involved in any computation. (There is no reason beyond simplifying the analysis to 
make this assumption.) 

Now suppose that the algorithm described in Section [7] is performed with limited precision. 
Consider first the case that the algorithm accepts, and let p = pt denote the density operator that is 
stored by the algorithm on the iteration t in which acceptance occurs. Note that it is not necessary 
to view that p is an approximation of something else; the simple fact that p causes acceptance will 
allow us to conclude that x G Ayes in a similar way to the error-free analysis. 

Specifically, we will construct an operator X G Pos (3^ ^ X) such that 0(X) < I3; and Tr(X) > 
(1 — 26)7. As before we will let Rq — Q^^^^pQ^^^^ and Pq = Try (Rq). This time, we must consider 
that the spectral decomposition is approximate. Let us write 

_ N 
PO = 

to denote the approximate value of the spectral decomposition, so that ||Po — Poll represents the 
error in this approximation, and let us assume that sufficient accuracy is taken so that 



Po-Po 



< 



4N||Q 



-1 1 



(7) 
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As above, this is significantly less accuracy than is available — for we could take 



-'0 - ^-^0 



< 2 



_2po';/(") 



if it were advantageous. Continuing on as before, let 

1 



^1 = -El^/)(^7l + E^/>;)(^7l' 
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j^S 



let Ri G Pos (3^ (g) A:") to be an extension of Pi for which ¥{Ro, Ki) = F(Po, Pi), and let 

We have that X > and 0(X) < 1^:^ as before, and to establish a lower bound on Tr(X) we 
again use the fact that 

l-Tr(v^RiV^) < IIQII ||Ko-Ki||i, 

as well as the bound 

||Ro-Ki|li < ^2Tr(Po)2 + 2Tr(Pi)2-4F(Po,Pi)2. 
Based on the bound it follows that 

Tr(Pi)2<Tr(Po)2 + c5 

and 

and therefore 
It follows that 
and therefore 



F(Po,Pi)' > (Tr(Po)-^ ) +S, 

||Ro-i^i|li < VuS\\Q-^\\. 
l-Tr(v^RiyQ) <2e, 

Tr(X) = 7Tr (v^KiTq) > (1 - 2e)j 



as required. 

Now let us consider the case that the algorithm rejects, and in particular let us focus on the 
operators Yq, . . . , Yt-i that are computed over the course of the algorithm. As for the case of 
acceptance, these operators are not viewed as approximations to anything: the fact that these 
operators exist and cause rejection in the algorithm is enough to conclude that x G A^q. Let us 
continue to write 



Wt+i = exp (^-^0*(Yo + ■ ■ ■ + YO) 



and pt = Wf / Tr(Wf ) for each t = 0, . . . ,T — 1; but we must keep in mind that the algorithm only 
computes approximations of these operators. The algorithm must also approximate the spectral 
decomposition of each ^{pt), where the source of errors in this case comes from both the spectral 
decomposition computation and the fact that pt is approximated. 
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Now, in the error free analysis, the conditions 



Tr(yt) < 7, (Pt,0*(yf)) = 1, and ||^<I'*(yf) || < 1 
were proved, and these conditions allowed us to conclude that Y satisfies 

0*(y) > \y^x and Tr(y) < (1 + £)7. 
If we follow precisely the same proof, but with the condition (pt, <!>*(¥()) = 1 replaced by 

(pt,0*(y,)) >l-a 

for some choice of a > 0, we once again find immediately that Tr(y) < (l + £)7. This time we 
have 

f.^* (^o + '-'+Yt-iW ^ ^ , X In(NM) 

Anm ^ J J > (l-^)exp(->^)- 

but under the assumption a < yf- /\2, say, it follows again that O* (y) > \y^x- 

Thus, given that the conditions Tr(yt) < 7 and || 5<^* {Yf) |j < 1 follow from an inspection of the 
algorithm as before, it suffices to compute the matrix exponentials and spectral decompositions 
with sufficient accuracy that {pt, O* {Yt)) > 1 — tj^ /VI. This is easily done: as the argument of the 
matrix exponentials have norm bounded by T, one is able to compute both the matrix exponentials 
and the spectral decompositions with exponentially greater accuracy in NC than is required. 



9 Conclusion 

We have proved that QIP(2) C PSPACE using a semidefinite programming formulation of the 
maximum acceptance probability of two-message quantum interactive proof systems, along with 
the multiplicative weights update method for verifying these values. An obvious question re- 
mains: can this method be extended, or some other method devised, to prove QIP = PSPACE? 
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